I'm confused about Authenticated Roles in an Identity Pool when using Amplify for Auth.

I've built a simple React application that will make REST calls to an API Gateway which has a Resource Policy on it to control access. I've setup a User Pool, App Client and Identity Pool with Authenticated Roles that all match, but when running my application I'm confused about how and where I should be getting the roles from my Identity Pool and then how I should be passing them to the request to API Gateway.

I'm not sure exactly where to troubleshoot, but I do see that neither the idToken or accessToken in my signInUserSession contain any role information, so presumably the bearer token I'm sending in doesn't contain this information either.

Right now, all requests to API gateway result in 403 with the message 'User: anonymous is not authorized to perform: execute-api:Invoke on resource blabla'

My React App (simplified a bit):

import React, { useEffect } from 'react';
import { Amplify, Auth, API } from 'aws-amplify';
import { withAuthenticator } from '@aws-amplify/ui-react';
import '@aws-amplify/ui-react/styles.css';

const awsmobile = {
    "aws_project_region": "us-east-1",
    "aws_cognito_identity_pool_id": "us-east-1:bla-blabla-bla-blabla",
    "aws_cognito_region": "us-east-1",
    "aws_user_pools_id": "us-east-1_XXXXXXXXX",
    "aws_user_pools_web_client_id": "foostuffboostuff",
    "oauth": {
        "domain": "jefarr-test.auth.us-east-1.amazoncognito.com"
    },
    "aws_cloud_logic_custom": [
         {
             "name": "Cognito Test API",
             "endpoint": "https://foobar.execute-api.us-east-1.amazonaws.com/Test",
             "region": "us-east-1"
         }
     ]
 
};

Amplify.configure(awsmobile)

function App({ signOut, user }) {

    async function callApi() {
      const user = await Auth.currentAuthenticatedUser()
      const token = "Bearer: " + user.signInUserSession.idToken.jwtToken
      const apiName = 'Cognito Test API';
      const path = '/';
  
      const requestData = {
          headers: {
              Authorization: token
          }
      }
      const data = await API.get(apiName, path, requestData)
      console.log("data: ", data)
    }
        
    return (
    <>
      <h1>Hello {user.username}</h1>
      <button onClick={signOut}>Sign out</button>
      <button onClick={callApi}>Call Api</button>
    </>
  
  );
}
export default withAuthenticator(App);

How can I get these requests to API Gateway to work with the Resource Policy in place?